[PATCH 0/1] Samba security update

[PATCH 0/1] Samba security update

[Leo Famulari]

There is a security update of Samba: version 4.3.7 and a regression fix 
in 4.3.8 [0]. I have updated our package to version 4.3.8 with commit
645deac3264744ec09c027a8b9762fdf62aced70.

This update addresses the following vulnerabilities:

o  CVE-2015-5370 (Multiple errors in DCE-RPC code)

o  CVE-2016-2110 (Man in the middle attacks possible with NTLMSSP)

o  CVE-2016-2111 (NETLOGON Spoofing Vulnerability)

o  CVE-2016-2112 (LDAP client and server don't enforce integrity)

o  CVE-2016-2113 (Missing TLS certificate validation)

o  CVE-2016-2114 ("server signing = mandatory" not enforced)

o  CVE-2016-2115 (SMB IPC traffic is not integrity protected)

o  CVE-2016-2118 (SAMR and LSA man in the middle attacks possible)

Please update your installations.

[0]
https://www.samba.org/samba/history/samba-4.3.8.html
https://www.samba.org/samba/history/security.html


Leo Famulari (1):
  gnu: samba: Update to 4.3.8.

 gnu/packages/samba.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.7.3

[PATCH 1/1] gnu: samba: Update to 4.3.8.

[Leo Famulari]

Fixes CVE-2015-5730, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112,
CVE-2016-2113, CVE-2016-2114, CVE-2016-2115, CVE-2016-2118.

* gnu/packages/samba.scm (samba): Update to 4.3.8.
---
 gnu/packages/samba.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/samba.scm b/gnu/packages/samba.scm
index 8c4f064..8aac6a5 100644
--- a/gnu/packages/samba.scm
+++ b/gnu/packages/samba.scm
@@ -99,14 +99,14 @@ anywhere.")
 (define-public samba
   (package
     (name "samba")
-    (version "4.3.6")
+    (version "4.3.8")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://www.samba.org/samba/ftp/stable/samba-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "0929fpk2pq4v389naai519xvsm9bzpar4jlgjxwlx1cnn6jyql9j"))))
+               "041b5frh4ikcka922aqhqjvlv4w2s7jycyykpvsknj0a79ncd79p"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
-- 
2.7.3

Re: [PATCH 0/1] Samba security update

[Ludovic Courtès]

Leo Famulari <leo@famulari.name> skribis:

> There is a security update of Samba: version 4.3.7 and a regression fix 
> in 4.3.8 [0]. I have updated our package to version 4.3.8 with commit
> 645deac3264744ec09c027a8b9762fdf62aced70.
>
> This update addresses the following vulnerabilities:

Thank you!

Ludo’.